# @auto-it/npm > NPM publishing plugin for auto Latest version **11.3.6** (published 2025-11-14) · MIT license · 0 weekly downloads ## Install ```sh npm install @auto-it/npm pnpm add @auto-it/npm yarn add @auto-it/npm bun add @auto-it/npm ``` ## Health **Score 55/100 (C)** — status: stable. Positive: has types; no vulnerabilities; high quality score. Warnings: low downloads; no esm support. ## Facts | | | |---|---| | Version | 11.3.6 | | Published | 2025-11-14 | | First published | 2019-05-17 | | Weekly downloads | 0 | | License | MIT | | TypeScript types | bundled | | Module format | CommonJS | | Dependencies | 14 | | Unpacked size | 113.9 KB | | Known vulnerabilities | 0 | | Install scripts | no | | GitHub stars | 2494 | | Author | Andrew Lisowski | | Maintainers | alisowski | | Keywords | automation, semantic, release, github, labels, automated, continuos integration, changelog, npm, lerna | ## Links - npm: https://www.npmjs.com/package/@auto-it/npm - Repository: https://github.com/intuit/auto - Homepage: https://github.com/intuit/auto#readme - Issues: https://github.com/intuit/auto/issues - npm.io page: https://npm.io/package/@auto-it/npm ## Dependencies (14) - [fp-ts](https://npm.io/package/fp-ts.md) ^2.5.3 - [io-ts](https://npm.io/package/io-ts.md) ^2.1.2 - [tslib](https://npm.io/package/tslib.md) 2.1.0 - [endent](https://npm.io/package/endent.md) ^2.1.0 - [env-ci](https://npm.io/package/env-ci.md) ^5.0.1 - [semver](https://npm.io/package/semver.md) ^7.0.0 - [url-join](https://npm.io/package/url-join.md) ^4.0.0 - [user-home](https://npm.io/package/user-home.md) ^2.0.0 - [await-to-js](https://npm.io/package/await-to-js.md) ^3.0.0 - [registry-url](https://npm.io/package/registry-url.md) ^5.1.0 - [@auto-it/core](https://npm.io/package/@auto-it/core.md) 11.3.6 - [typescript-memoize](https://npm.io/package/typescript-memoize.md) ^1.0.0-alpha.3 - [get-monorepo-packages](https://npm.io/package/get-monorepo-packages.md) ^1.3.0 - [@auto-it/package-json-utils](https://npm.io/package/@auto-it/package-json-utils.md) 11.3.6 ## Alternatives - [cli-color](https://npm.io/package/cli-color.md) — 3.4M weekly downloads - [log](https://npm.io/package/log.md) — 1.3M weekly downloads - [logstash-client](https://npm.io/package/logstash-client.md) — 4.5K weekly downloads - [@nocobase/plugin-logger](https://npm.io/package/@nocobase/plugin-logger.md) — 2.0K weekly downloads - [child-process-debug](https://npm.io/package/child-process-debug.md) — 695 weekly downloads ## Recent versions - 11.3.6 (latest) — 2025-11-14 - 10.0.0-next.3 (next) — 2020-10-28 - 9.9.2-canary.1.06e1a137.0 (canary) — 2020-02-06 - 8.5.0 (version-branches) — 2019-12-17 - 11.3.5 — 2025-11-14 - 11.3.4 — 2025-11-14 - 11.3.3 — 2025-11-14 - 11.3.2 — 2025-11-14 - 11.3.0 — 2024-10-25 - 11.2.1 — 2024-08-28 - 11.2.0 — 2024-07-17 - 11.1.6 — 2024-04-04 - 11.1.5 — 2024-04-04 - 11.1.4 — 2024-04-04 - 11.1.3 — 2024-04-03 - … 961 more at https://npm.io/package/@auto-it/npm/versions ## README # NPM Plugin Publish to NPM. Works in both a monorepo setting and for a single package. This plugin is loaded by default when `auto` is installed through `npm`. If you configure `auto` to use any other plugin this will be lost. So you must add the `npm` plugin to your plugins array if you still want NPM functionality. ## Prerequisites To publish to npm you will need an `NPM_TOKEN` set in your environment. > Warning! Avoid using the `prepublishOnly` script as it can lead to errors. [Read more here.](https://intuit.github.io/auto/docs/welcome/quick-merge#beware-long-publishes) ## Installation This plugin is included with the `auto` CLI so you do not have to install it. To install if you are using the `auto` API directly: ```bash npm i --save-dev @auto-it/npm # or yarn add -D @auto-it/npm ``` > WARNING: You can only use one "package manager" at a time! > Mixing them will lead to undesired results. ## Usage ```json { "plugins": [ "npm", // or with options ["npm", { "forcePublish": false }] // other plugins ] } ``` > If you're using the `noVersionPrefix` option you will also need to add `tag-version-prefix=""` to your `.npmrc`. > Otherwise when npm versions your code the tag it creates will have the `v` and `auto` will get confused. ## Monorepo Usage The `npm` plugin works out of the box with `lerna` in both [`independent`](https://github.com/lerna/lerna#independent-mode) and [`fixed`](https://github.com/lerna/lerna#fixedlocked-mode-default) mode. `auto` works on a repo basis and should be run from the root of the repo, not on each sub-package. No additional setup is required. > Do you have a package in your monorepo you don't want to publish but still want versioned? > Just set that `"private": true` you that package's `package.json`! ## Options ### setRcToken When running the `shipit` command auto will try to set your `.npmrc` token while publishing. To disable this feature you must set the `setRcToken` to false. ```json { "plugins": [ [ "npm", { "setRcToken": false } ] ] } ``` ### forcePublish By default `auto` will force publish all packages for monorepos. To disable this behavior you must set the `forcePublish` to false. ```json { "plugins": [ [ "npm", { "forcePublish": false } ] ] } ``` ### exact To force all packages publish with [exact versions](https://github.com/lerna/lerna/blob/master/commands/version/README.md#--exact). ```json { "plugins": [ [ "npm", { "exact": true } ] ] } ``` ### subPackageChangelogs `auto` will create a changelog for each sub-package in a monorepo. You can disable this behavior by using the `subPackageChangelogs` option. ```json { "plugins": [ [ "npm", { "subPackageChangelogs": false } ] ] } ``` ### monorepoChangelog `auto` will group changelog lines by sub-packages in a monorepo. You can disable this behavior by using the `monorepoChangelog` option. ```json { "plugins": [ [ "npm", { "monorepoChangelog": false } ] ] } ``` ### commitNextVersion Whether to create a commit for "next" version. The default behavior will only create the tags. ```json { "plugins": [ [ "npm", { "commitNextVersion": true } ] ] } ``` ### legacyAuth When publishing packages that require authentication but you are working with an internally hosted npm registry that only uses the legacy Base64 version of username:password. This is the same as the NPM publish \_auth flag. For security this option only accepts a boolean. When this option is set true `auto` will pass `--_auth $NPM_TOKEN` to the publish command. Set `$NPM_TOKEN` to the "Base64 version of username:password". ```json { "plugins": [ [ "npm", { "legacyAuth": true } ] ] } ``` ### publishFolder When publishing packages from a folder other than the project root the `publishFolder` config can be set. When used with `npm` generates command similar to `npm publish ...` more info can be found here: [npm-publish](https://docs.npmjs.com/cli/v8/commands/npm-publish). When used with `lerna` in a monorepo, this functionality implements the `--contents ` flag, more info can be found here: [lerna publish --contents](https://github.com/lerna/lerna/tree/main/commands/publish#--contents-dir). > :exclamation: **NOTE**: This functionality should be combined with a valid npm [Life Cycle](https://docs.npmjs.com/cli/v8/using-npm/scripts#life-cycle-scripts) script, > otherwise the `version` of the produced package will not align with the calculated/expected version generated by `auto`. > See [Life Cycle Scripts](#life-cycle-scripts) for additional info. ```json { "plugins": [ [ "npm", { "publishFolder": "./dist/some-dir" } ] ] } ``` #### Life Cycle Scripts During the publish routine, this plugin will execute (`npm version`|`npx lerna version`), and then immediately follow-up with (`npm publish`|`npx lerna publish`). If you're attempting to publish a package from a directory other than the project root, its likely you're doing some sort of repository or package.json manipulation in an attempt to cleanup (remove devDependencies, scripts, fields) or otherwise manually construct your published package. Since this process is likely invoked prior to the `version` and `publish` event enacted by this plugin, the `version` in your processed `package.json` would not match the new `version` the plugin is attempting to publish (unless you've accounted for this in some other fashion). This simply means we need to insert ourselves between the `version` and `publish` stages of this plugin and re-process or otherwise update the `package.json` file in our `publishFolder`. Appropriate life cycle scripts (which operate after `version` but before `publish`) would include [`postversion`, `prepublishOnly`, or `prepack`]. Its worth noting the `postversion` life cycle script will be enacted in the context of your root `package.json` file, while `prepublishOnly` and `prepack` would be enacted in the context of your `publishFolder` `package.json` file. Example life cycle script which is triggered after (`npm version`|`npx lerna version`) and before (`npm publish`|`npx lerna publish`): ``` { "scripts": { "postversion": "cd && npm version $npm_package_version --no-git-tag-version --no-commit-hooks --ignore-scripts", } } ``` > :warning: Warning! Use caution when pairing long-running life cyle scripts with auto. [Read more here.](https://intuit.github.io/auto/docs/welcome/quick-merge#beware-long-publishes) ### canaryScope Publishing canary versions comes with some security risks. If your project is private you have nothing to worry about and can skip these, but if your project is open source there are some security holes. > :warning: This feature works pretty easily/well for single packages. In a monorepo we have to deal with a lot more, and this options should be treated as experimental. #### Setup 1. Create a test scope that you publish canaries under (ex: `@auto-canary` or `@auto-test`) 2. Create a user that only has access to that scope 3. Set the default `NPM_TOKEN` to a token that can publish to that scope (this is used for any pull request) 4. Set up a `secure` token that is only accessible on the main fork (still named `NPM_TOKEN`) 5. Set up alias (only monorepos) Step 3 might not be possible on your build platform. The following are the ways the `auto` team knows how to do it. If you do not see the method for you build platform, please make a pull request! **Platform Solutions:** - [CircleCI Context](https://circleci.com/docs/2.0/contexts/) - Contexts provide a mechanism for securing and sharing environment variables across projects. The environment variables are defined as name/value pairs and are injected at runtime. ```json { "plugins": [ [ "npm", { "canaryScope": "@auto-canary" } ] ] } ``` ##### Set up alias If you are managing a non-monorepo you do not have to do anything for this step! If you manage a monorepo we still have to do handle our packages importing each other. Since we just changed the name of the package all imports to our packages are now broken! There are multiple ways to make this work and the solution might be different depending on your build target. - [module-alias](https://www.npmjs.com/package/module-alias) - Modifiy node's require for your canary deploys (This is what `auto` uses). Useful for node packages - [Webpack Aliases](https://webpack.js.org/configuration/resolve/) Modify scoped requires for webpack based projects. - [babel-plugin-module-resolver](https://www.npmjs.com/package/babel-plugin-module-resolver) - A Babel plugin to add a new resolver for your modules when compiling your code using Babel. ## Troubleshooting ## npm ERR! need auth auth required for publishing This error will occur when you do not have a `NPM_TOKEN` set. ### Still getting errors?! Make sure that `npm` is trying to publish to the correct registry. Force `npm`/`lerna` to use the public registry by adding the following to your package.json: ```json { "publishConfig": { "registry": "https://registry.npmjs.org/", "access": "public" } } ``` --- _Source: https://npm.io/package/@auto-it/npm · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._